CN114389736A - Time synchronization safety monitoring method and system based on long-term and short-term memory network - Google Patents
Time synchronization safety monitoring method and system based on long-term and short-term memory network Download PDFInfo
- Publication number
- CN114389736A CN114389736A CN202111533700.3A CN202111533700A CN114389736A CN 114389736 A CN114389736 A CN 114389736A CN 202111533700 A CN202111533700 A CN 202111533700A CN 114389736 A CN114389736 A CN 114389736A
- Authority
- CN
- China
- Prior art keywords
- time
- long
- term memory
- memory network
- short
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04J—MULTIPLEX COMMUNICATION
- H04J3/00—Time-division multiplex systems
- H04J3/02—Details
- H04J3/06—Synchronising arrangements
- H04J3/0635—Clock or time synchronisation in a network
- H04J3/0638—Clock or time synchronisation among nodes; Internode synchronisation
- H04J3/0658—Clock or time synchronisation among packet nodes
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/044—Recurrent networks, e.g. Hopfield networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04J—MULTIPLEX COMMUNICATION
- H04J14/00—Optical multiplex systems
- H04J14/02—Wavelength-division multiplex systems
- H04J14/0227—Operation, administration, maintenance or provisioning [OAMP] of WDM networks, e.g. media access, routing or wavelength allocation
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y04—INFORMATION OR COMMUNICATION TECHNOLOGIES HAVING AN IMPACT ON OTHER TECHNOLOGY AREAS
- Y04S—SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS
- Y04S40/00—Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them
- Y04S40/20—Information technology specific aspects, e.g. CAD, simulation, modelling, system security
Landscapes
- Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Signal Processing (AREA)
- Computer Networks & Wireless Communication (AREA)
- General Engineering & Computer Science (AREA)
- Computing Systems (AREA)
- General Health & Medical Sciences (AREA)
- Mathematical Physics (AREA)
- Data Mining & Analysis (AREA)
- Molecular Biology (AREA)
- Computational Linguistics (AREA)
- Biophysics (AREA)
- General Physics & Mathematics (AREA)
- Evolutionary Computation (AREA)
- Software Systems (AREA)
- Biomedical Technology (AREA)
- Artificial Intelligence (AREA)
- Life Sciences & Earth Sciences (AREA)
- Health & Medical Sciences (AREA)
- Computer Hardware Design (AREA)
- Computer And Data Communications (AREA)
Abstract
The invention discloses a time synchronization safety monitoring method and a system based on a long-term and short-term memory network, wherein the monitoring method comprises the following steps: s1, a time synchronization safety monitoring system is set up, and the system comprises a master clock, a slave clock, a time information transmission subsystem, a channel attack subsystem, a time information acquisition subsystem, a time safety protection subsystem and an environment sensing subsystem; s2, acquiring basic data for training a time safety protection subsystem; s3, building a long-term and short-term memory network on the time safety protection subsystem, and training the long-term and short-term memory network based on the constructed training data set; and S4, carrying out field deployment by the time synchronization safety monitoring system, and transferring the long-term and short-term memory network model which is trained well before deployment to a field deployment environment for reinforcement learning. The method can eliminate the influence of environmental change and noise interference on attack identification accuracy, and improve the time synchronization attack identification accuracy.
Description
Technical Field
The invention relates to the technical field of time frequency, in particular to a time synchronization safety monitoring method and system based on a long-term and short-term memory network.
Background
The high-precision time synchronization technology has wide and important application in the fields of basic science, astronomical observation, positioning navigation, national defense safety, communication, finance and the like. The time transfer synchronization technology based on the optical fiber link gradually develops into a novel time synchronization technology due to the advantages of low loss and high stability.
The current time synchronization method based on the optical fiber link can be divided into unidirectional transmission and bidirectional transmission. The two-way time transmission method is more suitable for the application with long transmission distance and high transmission precision requirement. The precondition of the bidirectional time transmission method based on the optical fiber link is that the transmission time delay between two places is obtained by estimation or actual measurement and the like, the two-way transmission time delay of the system is symmetrical after the asymmetrical compensation of the transmission time delay of the system, and the time difference measured by the two places is used for compensating the time service clock, thereby realizing the clock synchronization. Therefore, the asymmetric attack maliciously applied by the outside can be hidden in the two-place clock synchronization error data and is difficult to accurately identify, and the system clock synchronization precision is seriously influenced.
The traditional time synchronization safety monitoring method sets a time synchronization error threshold value through the time synchronization error development and change characteristics of a statistical analysis system under the non-attack condition, compares the acquired time synchronization error data with the threshold value every time, and judges whether a system time synchronization transmission link is attacked or not. The time synchronization attack identification method based on threshold judgment needs to carry out statistical analysis on the clock development change characteristics of the system, and the accuracy of the statistical analysis seriously influences the attack identification accuracy. When the environment changes, the transmission characteristics of the time synchronization system change, and statistical analysis needs to be performed again. The time synchronization safety protection method based on the long and short term memory network does not need to measure and calculate each characteristic parameter in the system operation process at the beginning of model construction. In the training and learning process, the long-term and short-term memory network can filter out the influence of the inherent asymmetric quantity of the time synchronization system and the environmental interference on attack identification through learning, record the relation between the attack and the time error data change characteristic of the input network, and have better environmental adaptability and higher attack identification accuracy.
Disclosure of Invention
Aiming at the problems of poor anti-interference performance and low accuracy of the traditional time synchronization safety monitoring method, the invention provides a time synchronization safety monitoring method and a time synchronization safety monitoring system based on a long-term and short-term memory network, which do not need to carry out statistical analysis on the development and change characteristics of a system clock, and can eliminate the influence of environmental change and noise interference on attack identification accuracy so as to improve the time synchronization attack identification accuracy.
The technical scheme adopted by the invention is as follows:
a time synchronization safety monitoring method based on a long-term and short-term memory network comprises the following steps:
the method comprises the following steps of S1, building a time synchronization safety monitoring system, wherein the time synchronization safety monitoring system comprises a master clock, a slave clock, a time information transmission subsystem, a channel attack subsystem, a time information acquisition subsystem, a time safety protection subsystem and an environment sensing subsystem, the time information transmission subsystem is used for transmitting time signals for the master clock and the slave clock, the channel attack subsystem is used for applying channel attack between the master clock and the slave clock, the time information acquisition subsystem is used for acquiring the time signal information of the master clock and the slave clock in real time, the time safety protection subsystem is used for performing long-short term memory network training, and the environment sensing subsystem is used for acquiring environment parameters of a master clock end and a slave clock end;
s2, acquiring basic data for training the time safety protection subsystem: the time information acquisition subsystem acquires the time difference of time signals transmitted by a master clock and a slave clock at a master clock end by using a first time interval counter, and the time difference is recorded as TIC 1; acquiring the time difference of time signals transmitted from the slave clock and the master clock at the slave clock end by using a second time interval counter, and recording the time difference as TIC 2; the environment sensing subsystem collects the temperature and the humidity of the master clock end and records the temperature and the humidity as Temp1 and Hum1, and collects the temperature and the humidity of the slave clock end and records the temperature and the humidity as Temp2 and Hum 2;
s3, building a long-short term memory network on a time safety protection subsystem, constructing a sample data set for training the long-short term memory network, and training the long-short term memory network based on the constructed training data set to form a mature long-short term memory network model for time synchronization attack recognition;
s4, carrying out field deployment on the time synchronization safety monitoring system, and transferring the long-term and short-term memory network model which is trained well before deployment to a field deployment environment for reinforcement learning; after reinforcement learning, the TIC1, TIC2, Temp1, Hum1, Temp2 and Hum2 are used as the input of the long-short term memory network model, the output result is used as the judgment of the transmission link safety state, and the local clock synchronization error updating strategy is selected according to the judgment result.
Further, the step S3 includes:
s301, building a long-term and short-term memory network on a time safety protection subsystem;
s302, determining characteristic data and label data which are required to be included in the input long-term and short-term memory network;
s303, before the characteristic data are input into the long-term and short-term memory network, normalization processing is carried out on the characteristic data;
s304, before the normalized feature data are input into the long-term and short-term memory network, constructing batch data according to the network structure features;
step S305, determining label data for training the long-term and short-term memory network: the data of the non-attack tag is set to be 0, and the data of the attack tag is set to be 1;
step S306, training the long-term and short-term memory network: and updating parameters in the long and short term memory network according to the expected loss value by using an Adam optimization algorithm, training until the accuracy of the time safety protection subsystem on attack recognition under each condition is greater than a given target value, finishing the training, and determining the model parameters of the long and short term memory network.
Further, in step S301, the constructed long-short term memory network includes a long-short term memory layer, an interlayer Dropout, and a fully connected layer for output, wherein the long-short term memory layer includes long-short term memory neurons.
Further, in step S302, the input feature data includes time error data measured at two clock ends, i.e., TIC1 and TIC2, and temperature and humidity at two clock ends, i.e., Temp1, Hum1, Temp2, Hum2, and the tag data is a corresponding flag indicating whether to apply an attack.
Further, in step S304, the batch data is a 3-dimensional data matrix constructed according to the feature number, the time step and the batch processing size.
Further, in the training process of step S306, the environment where the time-synchronized security monitoring system is located includes various environments that can be encountered in field deployment, and the channel attack applied by the channel attack subsystem includes various attack modes.
Further, in the step S4, the method for migrating the pre-deployment training mature long and short term memory network model to the field deployment environment for reinforcement learning includes: after the field deployment is completed, the migrated long-short term memory network model is further trained according to the training data set obtained by the field deployment in step S3.
Further, in step S4, the method for determining the security status of the transmission link includes: providing a plurality of characteristic data for attack judgment at preset time intervals in the attack identification process, carrying out characteristic data normalization processing before prediction, adding the characteristic data to the foremost end of an input sequence, simultaneously discarding one data at the back end, and constructing a two-dimensional matrix according to the characteristic number and the time step for predicting the time synchronization error.
A time synchronization safety monitoring system comprises a master clock, a slave clock, a time information transmission subsystem, a channel attack subsystem, a time information acquisition subsystem, a time safety protection subsystem and an environment sensing subsystem, wherein the time information transmission subsystem is used for transmitting time signals for the master clock and the slave clock, the channel attack subsystem is used for applying channel attack between the master clock and the slave clock, the time information acquisition subsystem is used for acquiring the time signal information of the master clock and the slave clock in real time, the time safety protection subsystem is used for carrying out long-term and short-term memory network training, and the environment sensing subsystem is used for acquiring environment parameters of a master clock end and a slave clock end.
Further, the time safety monitoring system of the slave clock end is also included, and comprises:
the data processing module is used for storing and processing the related data of the whole time synchronization safety monitoring system, inputting the training of the long and short term memory network and constructing the label data;
the model training module is used for training the long-term and short-term memory network before the deployment of the time synchronization safety monitoring system;
the system safety state judgment module runs a well-trained long-term and short-term memory network and is used for judging the safety state of the deployed time synchronization safety monitoring system;
and the time error correction module determines a slave clock updating strategy according to the judged system safety state and controls the slave clock time updating.
The invention has the beneficial effects that:
on one hand, the invention does not need to measure, count and analyze the asymmetry and noise error of the system, can embody the relevant characteristics of the system in the form of weight in the network through the expression characteristics of input and output data in the training process, and meanwhile, the system has certain generalization capability, and when the attack amplitude changes, the system can still accurately judge and identify; on the other hand, the environmental parameters of the two-end clock system are also used as the input of the network, so that the error identification of the system safety state caused by the fluctuation of the photoelectric system due to environmental change can be avoided. Therefore, the time synchronization attack identification method adopting the long and short memory network has higher accuracy and wider application range.
Drawings
FIG. 1 is a flow chart for constructing a time synchronization safety monitoring system.
FIG. 2 is a schematic diagram of a time-synchronized safety monitoring system for training prior to deployment in the field.
FIG. 3 is a schematic diagram of a time-synchronized security monitoring system deployed in the field for training.
FIG. 4 is a schematic diagram of a time-synchronized security monitoring system deployed in the field.
FIG. 5 is a diagram of a long term memory network.
FIG. 6 is a block diagram of a long-short term memory network.
FIG. 7 is a diagram of a long-short term memory network neuron architecture.
Fig. 8 is a functional block diagram of a time safety monitoring system at the slave clock end.
Detailed Description
In order to more clearly understand the technical features, objects, and effects of the present invention, specific embodiments of the present invention will now be described. It should be understood that the detailed description and specific examples, while indicating the preferred embodiment of the invention, are intended for purposes of illustration only and are not intended to limit the scope of the invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments of the present invention without making any creative effort, shall fall within the protection scope of the present invention.
Example 1 (post-training deployment in laboratory settings)
For the purpose of illustrating the detailed description of the invention, reference is made to the accompanying drawings. And (3) constructing a time synchronization safety monitoring system in an experimental environment, as shown in figure 2. The method aims to prevent the problem that the system attack identification accuracy rate is reduced when a long-short term memory network which is trained to be mature before deployment is migrated to the system after deployment due to the fact that key characteristics of the system are changed relative to the laboratory environment in the deployment process. The system used for training in the laboratory environment is as consistent as possible with the state of the system actually deployed for attack recognition. Training a system before deployment, deploying the trained mature system on the spot, and judging the safety state of the system by the deployed system directly according to input data. The system construction and processing method is shown in figure 1.
Step S1: and (3) building a time synchronization safety monitoring system for training before deployment, as shown in fig. 2. The time synchronization safety monitoring system comprises a master clock, a slave clock, a time information transmission subsystem, a channel attack subsystem, a time information acquisition subsystem, a time safety protection subsystem and an environment sensing subsystem, wherein the time information transmission subsystem is used for transmitting time signals for the master clock and the slave clock, the channel attack subsystem is used for applying channel attack between the master clock and the slave clock, the time information acquisition subsystem is used for acquiring the time signal information of the master clock and the slave clock in real time, the time safety protection subsystem is used for carrying out long-term and short-term memory network training, and the environment sensing subsystem is used for acquiring environment parameters of a master clock end and a slave clock end. Wherein the environment sensing subsystem at the master clock end can transmit the collected environment parameters (temperature, humidity, etc.) to the slave clock end through the optical fiber link in the form of optical signals. The optical fiber link adopts a wavelength division multiplexing mode to carry out information transmission, the wavelength of a time signal transmitted from a master clock end to a slave clock in the optical fiber link is different from that of a time signal transmitted from the slave clock end to the master clock, and the wavelength difference is as small as possible in order to reduce the asymmetry of the system caused by dispersion. At this time, the influence of asymmetry of the transmission link caused by the change of the environment of the optical fiber link on the system is small and can be ignored, so that the environment sensing system is not deployed in the optical fiber link.
Step S2: and acquiring basic data for training the time safety protection subsystem. The time information acquisition subsystem acquires the time difference of time signals transmitted by a master clock and a slave clock at a master clock end by using a first time interval counter, and the time difference is recorded as TIC 1; acquiring the time difference of time signals transmitted from the slave clock and the master clock at the slave clock end by using a second time interval counter, and recording the time difference as TIC 2; the environment sensing subsystem collects environment parameters of the main clock: temperature and humidity are recorded as Temp1 and Hum1, and the environmental parameters of the slave clock end are collected as follows: temperature and humidity were designated Temp2 and Hum 2.
Step S3: after the time synchronization safety monitoring system is built and before the time synchronization safety monitoring system is deployed on the spot, a long short-term memory network (LSTM) is built on a time safety protection subsystem, processed time sequences TIC1 and TIC2 and environment parameter sequences Temp1, Hum1, Temp2 and Hum2 are used as input sequences under the conditions of attack, no attack and various environment changes, processed attack judgment identification values are used as label data to train the long short-term memory network, the environment of the system in the training process comprises various environments possibly encountered in the field deployment, and the applied channel attack comprises various possible attack modes. And training until the accuracy of the system for identifying the attack is higher than the set target value under each condition.
Further, in the step S3, the specific details of the system training are:
step S301: building a long-short term memory network in a time safety protection system, wherein the built network structure body is shown in fig. 5, the structure totally comprises 4 long-short term memory network layers, and the first layer comprises 300 long-short term memory neurons; the numbers of neurons in the second, third and fourth layers are: 300. 150 and 100. Dropout exists between long and short term memory network layers, and when Dropout transmits information between multiple layers of cells at the same time t, neurons are randomly discarded according to given probability, so that the networks trained at each time are different, each Batch is equivalent to training one network, and overfitting regularization is effectively avoided.
Step S302: and determining the characteristic data contained in the input long-term and short-term memory network. The input feature data should include two feature data, TIC1 and TIC 2. The characteristic data TIC1 and TIC2 include clock difference information of a local clock with respect to a reference clock, asymmetry information of a transmission link itself, asymmetry information caused by an attack, and interference information such as noise. The TIC1 and the TIC2 are used as feature data for training the long-term and short-term memory network, effective feature information and ineffective feature information for attack judgment in the TIC1 and the TIC2 can be determined through training, and interference information for attack judgment, such as system noise, can be effectively filtered; the input characteristic data should simultaneously include the temperature and humidity at two clock ends: temp1, Hum1, Temp2 and Hum 2. The temperature and the humidity have important influence on a photoelectric device of the time synchronization system, so that the wavelength of a laser of the time synchronization system is unstable, the electro-optic conversion time delay is jittered, and the symmetry of a time synchronization transmission link is influenced. In order to eliminate the influence of environmental factors on the time synchronization precision, the temperature and the humidity of a reference end and a local end are required to be used as input characteristics of a long-term and short-term memory network, the influence of the temperature and the humidity on system attack recognition is measured in the training process, and the interference factors of environmental change can be filtered from TIC1 and TIC2 in the attack recognition process.
Step S303: before the input feature data in step S302 is input into the long-term and short-term memory network, normalization processing should be performed on the data to improve learning and convergence speed.
Step S304: before the normalized data in step S303 is input into the long-term and short-term memory network, the data needs to construct batch data according to the network structure characteristics, and the overall structure is shown in fig. 6. The input data included 6 features total of TIC1, TIC2, Temp1, Hum1, Temp2, Hum 2. The time Step _ size of the input data is 100, and the Batch process Batch _ size is set to 256 to improve the training efficiency. The data structure input to the long-short term memory network is therefore 6 x 100 x 256.
Step S305: and determining label data for training the long-term and short-term memory network. The non-attack tag data is set to 0, and the attack tag data is set to 1.
Step S306: and training the long-term and short-term network. And updating parameters in the long-short term memory network according to the expected loss value by using an Adam optimization algorithm.
In order to better implement the scheme, further, the long-short term memory neuron in step S301 includes a forgetting gate, an input gate, and an output gate, and the structure is shown in fig. 7. The calculation method is as follows:
forget the door: (t) ═ σ (w)f·[xt,h(t-1)]+bf)
An input gate: i (t) ═ σ (w)i·[xt,h(t-1)]+bi)
An output gate: o (t) ═ σ (w)o·[xt,h(t-1)]+bo)
And (3) long-term memory updating:
short-term memory updating: h (t) (o (t) × tanh (c (t))
Wherein, the control function sigma () of the forgetting gate, the input gate and the output gate is a sigmoid function, and the value range [0,1 ]]Controlling the proportion of the influence of the characteristic quantity on the network; w is af、wi、woIs the corresponding gated network weight; bf、bi、boIs the corresponding gate offset; x is the number oftInputting characteristic data for the network in step S304; h (t-1) is the short-term memory state at the last time point; c (t-1) is a long-term memory state at the last time point; c (t) is the long-term memory state at the current time point; h (t) is the short-term memory state at the current time point.
The long-short term memory neurons consider both short term and long term memory during each sequence cycle. Important information is remembered as long as possible through the forgetting gate, the input gate and the output gate, and unimportant information is forgotten. The long and short term memory network for identifying the time synchronization attack can keep the change information of the slave clock relative to the master clock from the input data through training, filter the non-equilibrium coefficient of the system, the asymmetric variable quantity caused by the environmental change and the noise interference factors from TIC1 and TIC2, and realize the accurate identification of the time synchronization attack.
Step S4: and (3) carrying out on-site deployment by the time synchronization safety monitoring system, and transferring the long-term and short-term memory network model which is trained to be mature before deployment to an on-site deployment environment for carrying out system safety state monitoring. The structure of the security monitoring system for time synchronization attack identification is shown in fig. 4. And the TIC1, TIC2, Temp1, Hum1, Temp2 and Hum2 are used as the input of the long-short term memory network, and the output result is used as the judgment of the safety state of the transmission link. And selecting a local clock synchronization error updating strategy according to the judgment result.
Further, in the step S4, the specific details for the attack determination input data structure are:
construction of input data for post-deployment time-synchronization attack identification. In the attack identification process, the hardware system provides 6 feature data for time synchronization attack identification every 1s, before prediction, feature data normalization processing is carried out and added to the forefront end of an input sequence, and meanwhile, one data is lost at the back end, as shown in fig. 6, the input data for time synchronization attack identification is guaranteed to be a two-dimensional matrix of 6 x 100.
In order to achieve the above object, this embodiment further provides a time synchronization security monitoring system, as shown in fig. 4, which includes a master clock, a slave clock, a time information transmission subsystem, a channel attack subsystem, a time information collection subsystem, a time security protection subsystem, and an environment sensing subsystem, where the time information transmission subsystem is configured to transmit time signals for the master clock and the slave clock, the channel attack subsystem is configured to apply channel attack between the master clock and the slave clock, the time information collection subsystem is configured to collect time signal information of the master clock and the slave clock in real time, the time security protection subsystem is configured to perform long-term and short-term memory network training, and the environment sensing subsystem is configured to collect environment parameters of the master clock end and the slave clock end. The environment sensing subsystem comprises a master clock end temperature and humidity acquisition unit and a slave clock end temperature and humidity acquisition unit, wherein the master clock end can transmit acquired environment parameters (temperature, humidity and the like) to the slave clock end through an optical fiber link.
In particular, the time synchronization security monitoring system comprises a time security monitoring system at the slave clock end, as shown in fig. 8, the system comprises a data processing module: the structure of input and label data used for storing and processing the related data of the whole time synchronization safety monitoring system and training a long-term and short-term memory network; a model training module: the method is used for training the long-term and short-term memory network before the deployment of the time synchronization safety monitoring system; a system safety state judging module: operating a well-trained long-term and short-term memory network for judging the safety state of the deployed time synchronization safety monitoring system; a time error correction module: and determining a slave clock updating strategy according to the judged system safety state, and controlling the slave clock time updating.
Example 2 (post deployment training in real-world environment)
For the purpose of illustrating the detailed description of the invention, reference is made to the accompanying drawings. A time synchronization security monitoring system for time synchronization attack recognition training is deployed in the field as shown in fig. 3. And training the long-term and short-term memory network according to the data acquired after the deployment on the spot is finished. The system after training is mature is shown in fig. 4, and the safety state of the system can be judged according to data collected on site. The system construction and processing method is shown in figure 1.
Step S1: and (3) building a time synchronization safety monitoring system for training after deployment, as shown in fig. 3. The time synchronization safety monitoring system comprises a master clock, a slave clock, a time information transmission subsystem, a channel attack subsystem, a time information acquisition subsystem, a time safety protection subsystem and an environment sensing subsystem, wherein the time information transmission subsystem is used for transmitting time signals for the master clock and the slave clock, the channel attack subsystem is used for applying channel attack between the master clock and the slave clock, the time information acquisition subsystem is used for acquiring the time signal information of the master clock and the slave clock in real time, the time safety protection subsystem is used for carrying out long-term and short-term memory network training, and the environment sensing subsystem is used for acquiring environment parameters of a master clock end and a slave clock end. The environment sensing system at the master clock end can transmit the collected environment parameters (temperature, humidity and the like) to the slave clock end through the optical fiber link in the form of optical signals. The optical fiber link adopts a wavelength division multiplexing mode to carry out information transmission, the wavelength of a time signal transmitted from a master clock end to a slave clock in the optical fiber link is different from that of a time signal transmitted from the slave clock end to the master clock, and the wavelength difference is as small as possible in order to reduce the asymmetry of the system caused by dispersion. At this time, the influence of asymmetry of the transmission link caused by the change of the environment of the optical fiber link on the system is small and can be ignored, so that the environment sensing system is not deployed in the optical fiber link.
Step S2: and acquiring basic data for training the time safety protection subsystem. The time information acquisition subsystem acquires the time difference of time signals transmitted by a master clock and a slave clock at a master clock end by using a first time interval counter, and the time difference is recorded as TIC 1; acquiring the time difference of time signals transmitted from the slave clock and the master clock at the slave clock end by using a second time interval counter, and recording the time difference as TIC 2; the environment sensing subsystem collects environment parameters of the main clock: temperature and humidity are recorded as Temp1 and Hum1, and the environmental parameters of the slave clock end are collected as follows: temperature and humidity were designated Temp2 and Hum 2.
Step S3: after the time synchronization security monitoring training system is deployed on the spot, a long-short-term memory network (LSTM) is built on a time security protection subsystem, processed time sequences TIC1 and TIC2 and environment parameter sequences Temp1, Hum1, Temp2 and Hum2 are used as input sequences under the conditions of attack, no attack and various environment changes, the processed attack judgment identification value is used as label data to train the long-short-term memory network, the environment of the system in the training process comprises various environments possibly encountered in the field deployment, and the applied channel attack comprises various possible attack modes. And training until the accuracy of the system for identifying the attack is higher than the set target value under each condition.
Further, in the step S3, the specific details of the system training are:
step S301: building a long-short term memory network in a time safety protection system, wherein the built network structure body is shown in fig. 5, the structure totally comprises 4 long-short term memory network layers, and the first layer comprises 300 long-short term memory neurons; the numbers of neurons in the second, third and fourth layers are: 300. 150 and 100. Dropout exists between long and short term memory network layers, and when Dropout transmits information between multiple layers of cells at the same time t, neurons are randomly discarded according to given probability, so that the networks trained at each time are different, each Batch is equivalent to training one network, and overfitting regularization is effectively avoided.
Step S302: and determining the characteristic data contained in the input long-term and short-term memory network. The input feature data should include two feature data, TIC1 and TIC 2. The characteristic data TIC1 and TIC2 include clock difference information of a local clock with respect to a reference clock, asymmetry information of a transmission link itself, asymmetry information caused by an attack, and interference information such as noise. The TIC1 and the TIC2 are used as feature data for training the long-term and short-term memory network, effective feature information and ineffective feature information for attack judgment in the TIC1 and the TIC2 can be determined through training, and interference information for attack judgment, such as system noise, can be effectively filtered; the input characteristic data should simultaneously include the temperature and humidity at two clock ends: temp1, Hum1, Temp2 and Hum 2. The temperature and the humidity have important influence on a photoelectric device of the time synchronization system, so that the wavelength of a laser of the time synchronization system is unstable, the electro-optic conversion time delay is jittered, and the symmetry of a time synchronization transmission link is influenced. In order to eliminate the influence of environmental factors on the time synchronization precision, the temperature and the humidity of a reference end and a local end are required to be used as input characteristics of a long-term and short-term memory network, the influence of the temperature and the humidity on system attack recognition is measured in the training process, and the interference factors of environmental change can be filtered from TIC1 and TIC2 in the attack recognition process.
Step S303: before the input feature data in step S302 is input into the long-term and short-term memory network, normalization processing should be performed on the data to improve learning and convergence speed.
Step S304: before the normalized data in step S303 is input into the long-term and short-term memory network, the data needs to construct batch data according to the network structure characteristics, and the overall structure is shown in fig. 6. The input data included 6 features total of TIC1, TIC2, Temp1, Hum1, Temp2, Hum 2. The time Step _ size of the input data is 100, and the Batch process Batch _ size is set to 256 to improve the training efficiency. The data structure input to the long-short term memory network is therefore 6 x 100 x 256.
Step S305: and determining label data for training the long-term and short-term memory network. The non-attack tag data is set to 0, and the attack tag data is set to 1.
Step S306: and training the long-term and short-term network. And updating parameters in the long-short term memory network according to the expected loss value by using an Adam optimization algorithm.
In order to better implement the scheme, further, the long-short term memory neuron in step S301 includes a forgetting gate, an input gate, and an output gate, and the structure is shown in fig. 7. The calculation method is as follows:
forget the door: (t) ═ σ (w)f·[xt,h(t-1)]+bf)
An input gate: i (t) ═ σ (w)i·[xt,h(t-1)]+bi)
An output gate: o (t) ═ σ (w)o·[xt,h(t-1)]+bo)
And (3) long-term memory updating:
short-term memory updating: h (t) (o (t) × tanh (c (t))
Wherein, the control function sigma () of the forgetting gate, the input gate and the output gate is a sigmoid function, and the value range [0,1 ]]Controlling the proportion of the influence of the characteristic quantity on the network; w is af、wi、woIs the corresponding gated network weight; bf、bi、boIs the corresponding gate offset; x is the number oftInputting characteristic data for the network in step S304; h (t-1) is the short-term memory state at the last time point; c (t-1) is a long-term memory state at the last time point; c (t) is the long-term memory state at the current time point; h (t) is the short-term memory state at the current time point.
The long-short term memory neurons consider both short term and long term memory during each sequence cycle. Important information is remembered as long as possible through the forgetting gate, the input gate and the output gate, and unimportant information is forgotten. The long and short term memory network for identifying the time synchronization attack can keep the change information of the slave clock relative to the master clock from the input data through training, filter the non-equilibrium coefficient of the system, the asymmetric variable quantity caused by the environmental change and the noise interference factors from TIC1 and TIC2, and realize the accurate identification of the time synchronization attack.
Step S4: the mature long and short term memory network model trained after the time synchronization security monitoring system is deployed can be directly used for time synchronization attack identification. The structure of the security monitoring system for time synchronization attack identification is shown in fig. 4. And the TIC1, TIC2, Temp1, Hum1, Temp2 and Hum2 are used as the input of the long-short term memory network, and the output result is used as the judgment of the safety state of the transmission link. And selecting a local clock synchronization error updating strategy according to the judgment result.
Further, in the step S4, the specific details for the attack determination input data structure are:
construction of input data for post-deployment time-synchronization attack identification. In the attack identification process, the hardware system provides 6 feature data for time synchronization attack identification every 1s, before prediction, feature data normalization processing is carried out and added to the forefront end of an input sequence, and meanwhile, one data is lost at the back end, as shown in fig. 6, the input data for time synchronization attack identification is guaranteed to be a two-dimensional matrix of 6 x 100.
In order to achieve the above object, this embodiment further provides a time synchronization security monitoring system, as shown in fig. 4, which includes a master clock, a slave clock, a time information transmission subsystem, a channel attack subsystem, a time information collection subsystem, a time security protection subsystem, and an environment sensing subsystem, where the time information transmission subsystem is configured to transmit time signals for the master clock and the slave clock, the channel attack subsystem is configured to apply channel attack between the master clock and the slave clock, the time information collection subsystem is configured to collect time signal information of the master clock and the slave clock in real time, the time security protection subsystem is configured to perform long-term and short-term memory network training, and the environment sensing subsystem is configured to collect environment parameters of the master clock end and the slave clock end. The environment sensing subsystem comprises a master clock end temperature and humidity acquisition unit and a slave clock end temperature and humidity acquisition unit. The master clock end can transmit the collected environmental parameters (temperature, humidity and the like) to the slave clock end through the optical fiber link.
In particular, the time synchronization security monitoring system comprises a time security monitoring system at the slave clock end, as shown in fig. 8, the system comprises a data processing module: the structure of input and label data used for storing and processing the related data of the whole time synchronization safety monitoring system and training a long-term and short-term memory network; a model training module: the method is used for training the long-term and short-term memory network after the time synchronization safety monitoring system is deployed; a system safety state judging module: operating a well-trained long-term and short-term memory network for judging the safety state of the deployed time synchronization safety monitoring system; a time error correction module: and determining a slave clock updating strategy according to the judged system safety state, and controlling the slave clock time updating.
Example 3 (environmental training during experiment and on-site reinforcement training after deployment)
For the purpose of illustrating the detailed description of the invention, reference is made to the accompanying drawings. Firstly, a time synchronization safety monitoring system for training the long-term and short-term memory network is built in a laboratory environment, and as shown in fig. 2, data are acquired in the laboratory environment to train the long-term and short-term memory network; after training is mature, deploying a time synchronization safety monitoring system on the spot, and performing reinforced training on a long-term and short-term memory network transferred from a laboratory according to data acquired on the spot until the network training is mature as shown in fig. 3; and then, training a mature time synchronization security monitoring system on site, as shown in fig. 4, and being used for monitoring time synchronization attack identification. The system construction and processing method is shown in figure 1.
Step S1: and (3) building a time synchronization safety monitoring system for training before deployment, as shown in fig. 2. The time synchronization safety monitoring system comprises a master clock, a slave clock, a time information transmission subsystem, a channel attack subsystem, a time information acquisition subsystem, a time safety protection subsystem and an environment sensing subsystem, wherein the time information transmission subsystem is used for transmitting time signals for the master clock and the slave clock, the channel attack subsystem is used for applying channel attack between the master clock and the slave clock, the time information acquisition subsystem is used for acquiring the time signal information of the master clock and the slave clock in real time, the time safety protection subsystem is used for carrying out long-term and short-term memory network training, and the environment sensing subsystem is used for acquiring environment parameters of a master clock end and a slave clock end. Wherein the environment sensing subsystem at the master clock end can transmit the collected environment parameters (temperature, humidity, etc.) to the slave clock end through the optical fiber link in the form of optical signals. The optical fiber link adopts a wavelength division multiplexing mode to carry out information transmission, the wavelength of a time signal transmitted from a master clock end to a slave clock in the optical fiber link is different from that of a time signal transmitted from the slave clock end to the master clock, and the wavelength difference is as small as possible in order to reduce the asymmetry of the system caused by dispersion. At this time, the influence of asymmetry of the transmission link caused by the change of the environment of the optical fiber link on the system is small and can be ignored, so that the environment sensing system is not deployed in the optical fiber link.
Step S2: and acquiring basic data for training the time safety protection subsystem. The time information acquisition subsystem acquires the time difference of time signals transmitted by a master clock and a slave clock at a master clock end by using a first time interval counter, and the time difference is recorded as TIC 1; acquiring the time difference of time signals transmitted from the slave clock and the master clock at the slave clock end by using a second time interval counter, and recording the time difference as TIC 2; the environment sensing subsystem collects environment parameters of the main clock: temperature and humidity are recorded as Temp1 and Hum1, and the environmental parameters of the slave clock end are collected as follows: temperature and humidity were designated Temp2 and Hum 2.
Step S3: after the time synchronization safety monitoring system is built and before the time synchronization safety monitoring system is deployed on the spot, a long short-term memory network (LSTM) is built on a time safety protection subsystem, processed time sequences TIC1 and TIC2 and environment parameter sequences Temp1, Hum1, Temp2 and Hum2 are used as input sequences under the conditions of attack, no attack and various environment changes, processed attack judgment identification values are used as label data to train the long short-term memory network, the environment of the system in the training process comprises various environments possibly encountered in the field deployment, and the applied channel attack comprises various possible attack modes. And training until the accuracy of the system for identifying the attack is higher than the set target value under each condition.
Further, in the step S3, the specific details of the system training are:
step S301: building a long-short term memory network in a time safety protection system, wherein the built network structure body is shown in fig. 5, the structure totally comprises 4 long-short term memory network layers, and the first layer comprises 300 long-short term memory neurons; the numbers of neurons in the second, third and fourth layers are: 300. 150 and 100. Dropout exists between long and short term memory network layers, and when Dropout transmits information between multiple layers of cells at the same time t, neurons are randomly discarded according to given probability, so that the networks trained at each time are different, each Batch is equivalent to training one network, and overfitting regularization is effectively avoided.
Step S302: and determining the characteristic data contained in the input long-term and short-term memory network. The input feature data should include two feature data, TIC1 and TIC 2. The characteristic data TIC1 and TIC2 include clock difference information of a local clock with respect to a reference clock, asymmetry information of a transmission link itself, asymmetry information caused by an attack, and interference information such as noise. The TIC1 and the TIC2 are used as feature data for training the long-term and short-term memory network, effective feature information and ineffective feature information for attack judgment in the TIC1 and the TIC2 can be determined through training, and interference information for attack judgment, such as system noise, can be effectively filtered; the input characteristic data should simultaneously include the temperature and humidity at two clock ends: temp1, Hum1, Temp2 and Hum 2. The temperature and the humidity have important influence on a photoelectric device of the time synchronization system, so that the wavelength of a laser of the time synchronization system is unstable, the electro-optic conversion time delay is jittered, and the symmetry of a time synchronization transmission link is influenced. In order to eliminate the influence of environmental factors on the time synchronization precision, the temperature and the humidity of a reference end and a local end are required to be used as input characteristics of a long-term and short-term memory network, the influence of the temperature and the humidity on system attack recognition is measured in the training process, and the interference factors of environmental change can be filtered from TIC1 and TIC2 in the attack recognition process.
Step S303: before the input feature data in step S302 is input into the long-term and short-term memory network, normalization processing should be performed on the data to improve learning and convergence speed.
Step S304: before the normalized data in step S303 is input into the long-term and short-term memory network, the data needs to construct batch data according to the network structure characteristics, and the overall structure is shown in fig. 6. The input data included 6 features total of TIC1, TIC2, Temp1, Hum1, Temp2, Hum 2. The time Step _ size of the input data is 100, and the Batch process Batch _ size is set to 256 to improve the training efficiency. The data structure input to the long-short term memory network is therefore 6 x 100 x 256.
Step S305: and determining label data for training the long-term and short-term memory network. The non-attack tag data is set to 0, and the attack tag data is set to 1.
Step S306: and training the long-term and short-term network. And updating parameters in the long-short term memory network according to the expected loss value by using an Adam optimization algorithm.
In order to better implement the scheme, further, the long-short term memory neuron in step S301 includes a forgetting gate, an input gate, and an output gate, and the structure is shown in fig. 7. The calculation method is as follows:
forget the door: (t) ═ σ (w)f·[xt,h(t-1)]+bf)
An input gate: i (t) ═ σ (w)i·[xt,h(t-1)]+bi)
An output gate: o (t) ═ σ (w)o·[xt,h(t-1)]+bo)
And (3) long-term memory updating:
short-term memory updating: h (t) (o (t) × tanh (c (t))
Wherein, the control function sigma () of the forgetting gate, the input gate and the output gate is a sigmoid function, and the value range [0,1 ]]Controlling the proportion of the influence of the characteristic quantity on the network; w is af、wi、woIs the corresponding gated network weight; bf、bi、b0Is the corresponding gate offset; x is the number oftInputting characteristic data for the network in step S304; h (t-1) is the short-term memory state at the last time point; c (t-1) is a long-term memory state at the last time point; c (t) is the long-term memory state at the current time point; h (t) is the short-term memory state at the current time point.
The long-short term memory neurons consider both short term and long term memory during each sequence cycle. Important information is remembered as long as possible through the forgetting gate, the input gate and the output gate, and unimportant information is forgotten. The long and short term memory network for identifying the time synchronization attack can keep the change information of the slave clock relative to the master clock from the input data through training, filter the non-equilibrium coefficient of the system, the asymmetric variable quantity caused by the environmental change and the noise interference factors from TIC1 and TIC2, and realize the accurate identification of the time synchronization attack.
Step S4: the time synchronization safety monitoring system is deployed on the spot, a mature long and short term memory network model trained before deployment is transferred to a field deployment environment for reinforcement learning, and the structure of the time synchronization safety monitoring system for reinforcement learning is shown in fig. 3. The structure of the security monitoring system for time synchronization attack identification after reinforcement learning is shown in fig. 4. And the TIC1, TIC2, Temp1, Hum1, Temp2 and Hum2 are used as the input of the long-short term memory network, and the output result is used as the judgment of the safety state of the transmission link. And selecting a local clock synchronization error updating strategy according to the judgment result.
Further, in the step S4, the specific details of the system reinforcement learning and the input data structure for attack determination are as follows:
step S401: the long and short term memory network reinforcement learning. After the field deployment is completed, the migrated long-short term memory network needs to be further trained according to the training data obtained by the field deployment in step S3. The problem of reduced attack identification accuracy caused by changes of system key parameters before and after deployment is solved, and the adaptability of the long-term and short-term memory network in the actual environment is improved.
Step S402: construction of input data for post-deployment time-synchronization attack identification. In the attack identification process, the hardware system provides 6 pieces of feature data for time synchronization attack identification every 1s, input feature data are subjected to normalization processing before prediction, the input data are added to the forefront of an input sequence, and meanwhile, one piece of data is discarded at the rear end, so that the input data for time synchronization attack identification are guaranteed to be a two-dimensional matrix of 6 x 100 as shown in fig. 6.
In order to achieve the above object, this embodiment further provides a time synchronization security monitoring system, as shown in fig. 4, which includes a master clock, a slave clock, a time information transmission subsystem, a channel attack subsystem, a time information collection subsystem, a time security protection subsystem, and an environment sensing subsystem, where the time information transmission subsystem is configured to transmit time signals for the master clock and the slave clock, the channel attack subsystem is configured to apply channel attack between the master clock and the slave clock, the time information collection subsystem is configured to collect time signal information of the master clock and the slave clock in real time, the time security protection subsystem is configured to perform long-term and short-term memory network training, and the environment sensing subsystem is configured to collect environment parameters of the master clock end and the slave clock end. The environment sensing subsystem comprises a master clock end temperature and humidity acquisition unit and a slave clock end temperature and humidity acquisition unit. The master clock end can transmit the collected environmental parameters (temperature, humidity and the like) to the slave clock end through the optical fiber link.
In particular, the time synchronization security monitoring system comprises a time synchronization security monitoring system at the slave clock end, as shown in fig. 8, the system comprises a data processing module: the structure of input and label data used for storing and processing the related data of the whole time synchronization safety monitoring system and training a long-term and short-term memory network; a model training module: the method is used for training the long-term and short-term memory network before the deployment of the time synchronization safety monitoring system; a system safety state judging module: operating a well-trained long-term and short-term memory network for judging the safety state of the deployed time synchronization safety monitoring system; a time error correction module: and determining a slave clock updating strategy according to the judged system safety state, and controlling the slave clock time updating.
The foregoing is illustrative of the preferred embodiments of this invention, and it is to be understood that the invention is not limited to the precise form disclosed herein and that various other combinations, modifications, and environments may be resorted to, falling within the scope of the concept as disclosed herein, either as described above or as apparent to those skilled in the relevant art. And that modifications and variations may be effected by those skilled in the art without departing from the spirit and scope of the invention as defined by the appended claims.
Claims (10)
1. A time synchronization safety monitoring method based on a long-term and short-term memory network is characterized by comprising the following steps:
the method comprises the following steps of S1, building a time synchronization safety monitoring system, wherein the time synchronization safety monitoring system comprises a master clock, a slave clock, a time information transmission subsystem, a channel attack subsystem, a time information acquisition subsystem, a time safety protection subsystem and an environment sensing subsystem, the time information transmission subsystem is used for transmitting time signals for the master clock and the slave clock, the channel attack subsystem is used for applying channel attack between the master clock and the slave clock, the time information acquisition subsystem is used for acquiring the time signal information of the master clock and the slave clock in real time, the time safety protection subsystem is used for performing long-short term memory network training, and the environment sensing subsystem is used for acquiring environment parameters of a master clock end and a slave clock end;
s2, acquiring basic data for training the time safety protection subsystem: the time information acquisition subsystem acquires the time difference of time signals transmitted by a master clock and a slave clock at a master clock end by using a first time interval counter, and the time difference is recorded as TIC 1; acquiring the time difference of time signals transmitted from the slave clock and the master clock at the slave clock end by using a second time interval counter, and recording the time difference as TIC 2; the environment sensing subsystem collects the temperature and the humidity of the master clock end and records the temperature and the humidity as Temp1 and Hum1, and collects the temperature and the humidity of the slave clock end and records the temperature and the humidity as Temp2 and Hum 2;
s3, building a long-short term memory network on a time safety protection subsystem, constructing a sample data set for training the long-short term memory network, and training the long-short term memory network based on the constructed training data set to form a mature long-short term memory network model for time synchronization attack recognition;
s4, carrying out field deployment on the time synchronization safety monitoring system, and transferring the long-term and short-term memory network model which is trained well before deployment to a field deployment environment for reinforcement learning; after reinforcement learning, the TIC1, TIC2, Temp1, Hum1, Temp2 and Hum2 are used as the input of the long-short term memory network model, the output result is used as the judgment of the transmission link safety state, and the local clock synchronization error updating strategy is selected according to the judgment result.
2. The method for monitoring time synchronization security based on long-short term memory network as claimed in claim 1, wherein said step S3 includes:
s301, building a long-term and short-term memory network on a time safety protection subsystem;
s302, determining characteristic data and label data which are required to be included in the input long-term and short-term memory network;
s303, before the characteristic data are input into the long-term and short-term memory network, normalization processing is carried out on the characteristic data;
s304, before the normalized feature data are input into the long-term and short-term memory network, constructing batch data according to the network structure features;
step S305, determining label data for training the long-term and short-term memory network: the data of the non-attack tag is set to be 0, and the data of the attack tag is set to be 1;
step S306, training the long-term and short-term memory network: and updating parameters in the long and short term memory network according to the expected loss value by using an Adam optimization algorithm, training until the accuracy of the time safety protection subsystem on attack recognition under each condition is greater than a given target value, finishing the training, and determining the model parameters of the long and short term memory network.
3. The method for monitoring time synchronization safety based on long-short term memory network as claimed in claim 2, wherein in the step S301, the constructed long-short term memory network includes a long-short term memory layer, an interlayer Dropout and a fully connected layer for output, wherein the long-short term memory layer includes long-short term memory neurons.
4. The method as claimed in claim 2, wherein in step S302, the input characteristic data includes time error data TIC1 and TIC2 measured at two clock ends and temperature and humidity data Temp1, Hum1, Temp2 and Hum2 measured at two clock ends, and the tag data is a corresponding flag indicating whether an attack is applied.
5. The method as claimed in claim 2, wherein in step S304, the batch data is a 3-dimensional data matrix constructed according to the feature number, the time step and the batch size.
6. The method for time-synchronized security monitoring based on long-and-short-term memory network as claimed in claim 2, wherein in the training process of step S306, the environment of the time-synchronized security monitoring system includes various environments that can be encountered in field deployment, and the channel attack applied by the channel attack subsystem includes various attack modes.
7. The method for time-synchronized security monitoring based on long-and-short term memory network as claimed in any one of claims 1 to 6, wherein the step S4 of migrating the pre-deployment training matured long-and-short term memory network model to the on-site deployment environment for reinforcement learning comprises: after the field deployment is completed, the migrated long-short term memory network model is further trained according to the training data set obtained by the field deployment in step S3.
8. The method for monitoring time synchronization security based on long-short term memory network as claimed in any one of claims 1-6, wherein the method for determining the security status of the transmission link in step S4 includes: providing a plurality of characteristic data for attack judgment at preset time intervals in the attack identification process, carrying out characteristic data normalization processing before prediction, adding the characteristic data to the foremost end of an input sequence, simultaneously discarding one data at the back end, and constructing a two-dimensional matrix according to the characteristic number and the time step for predicting the time synchronization error.
9. A time synchronization security monitoring system is characterized by comprising a master clock, a slave clock, a time information transmission subsystem, a channel attack subsystem, a time information acquisition subsystem, a time security protection subsystem and an environment sensing subsystem, wherein the time information transmission subsystem is used for transmitting time signals for the master clock and the slave clock, the channel attack subsystem is used for applying channel attack between the master clock and the slave clock, the time information acquisition subsystem is used for acquiring the time signal information of the master clock and the slave clock in real time, the time security protection subsystem is used for carrying out long-term memory network training, and the environment sensing subsystem is used for acquiring environment parameters of a master clock end and a slave clock end.
10. The time-synchronized safety monitoring system of claim 9, further comprising a slave-clock-side time safety monitoring system, the slave-clock-side time safety monitoring system comprising:
the data processing module is used for storing and processing the related data of the whole time synchronization safety monitoring system, inputting the training of the long and short term memory network and constructing the label data;
the model training module is used for training the long-term and short-term memory network before the deployment of the time synchronization safety monitoring system;
the system safety state judgment module runs a well-trained long-term and short-term memory network and is used for judging the safety state of the deployed time synchronization safety monitoring system;
and the time error correction module determines a slave clock updating strategy according to the judged system safety state and controls the slave clock time updating.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111533700.3A CN114389736B (en) | 2021-12-15 | 2021-12-15 | Time synchronization safety monitoring method and system based on long-term and short-term memory network |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111533700.3A CN114389736B (en) | 2021-12-15 | 2021-12-15 | Time synchronization safety monitoring method and system based on long-term and short-term memory network |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN114389736A true CN114389736A (en) | 2022-04-22 |
| CN114389736B CN114389736B (en) | 2023-05-09 |
Family
ID=81197599
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202111533700.3A Active CN114389736B (en) | 2021-12-15 | 2021-12-15 | Time synchronization safety monitoring method and system based on long-term and short-term memory network |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114389736B (en) |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20200252424A1 (en) * | 2019-01-31 | 2020-08-06 | Keysight Technologies, Inc. | Methods, systems, and computer readable media for detecting and mitigating effects of timing attacks in time sensitive networks |
| CN112637137A (en) * | 2020-12-08 | 2021-04-09 | 中国电子科技集团公司第三十研究所 | Optical fiber time synchronization monitoring method and system based on clock error dynamic model |
| CN112653684A (en) * | 2020-12-17 | 2021-04-13 | 电子科技大学长三角研究院(衢州) | Abnormal flow detection method based on multi-path feature perception long-term and short-term memory |
| WO2021122778A1 (en) * | 2019-12-18 | 2021-06-24 | Continental Automotive Gmbh | Method for securing the time synchronization of an ethernet on-board network |
| CN113722718A (en) * | 2021-08-24 | 2021-11-30 | 哈尔滨工业大学（威海） | Cloud edge collaborative industrial control network security protection method based on policy base |
-
2021
- 2021-12-15 CN CN202111533700.3A patent/CN114389736B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20200252424A1 (en) * | 2019-01-31 | 2020-08-06 | Keysight Technologies, Inc. | Methods, systems, and computer readable media for detecting and mitigating effects of timing attacks in time sensitive networks |
| WO2021122778A1 (en) * | 2019-12-18 | 2021-06-24 | Continental Automotive Gmbh | Method for securing the time synchronization of an ethernet on-board network |
| CN112637137A (en) * | 2020-12-08 | 2021-04-09 | 中国电子科技集团公司第三十研究所 | Optical fiber time synchronization monitoring method and system based on clock error dynamic model |
| CN112653684A (en) * | 2020-12-17 | 2021-04-13 | 电子科技大学长三角研究院(衢州) | Abnormal flow detection method based on multi-path feature perception long-term and short-term memory |
| CN113722718A (en) * | 2021-08-24 | 2021-11-30 | 哈尔滨工业大学（威海） | Cloud edge collaborative industrial control network security protection method based on policy base |
Non-Patent Citations (4)
| Title |
|---|
| EZZELDIN SHEREEN;GYÖRGY DÁN: "Model-Based and Data-Driven Detectors for Time Synchronization Attacks Against PMUs" * |
| ZIYANG GUO;YUQING NI;WING SHING WONG;LING SHI: "Time Synchronization Attack and Countermeasure for Multisystem Scheduling in Remote Estimation" * |
| 方勇;龙啸;黄诚;刘亮;: "基于LSTM与随机森林混合构架的钓鱼网站识别研究" * |
| 林果园;黄皓;: "通过时间同步提高分布式入侵检测系统的检测率" * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN114389736B (en) | 2023-05-09 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110995339B (en) | Method for extracting and identifying time-space information of distributed optical fiber sensing signal | |
| CN107688871B (en) | Water quality prediction method and device | |
| CN108335487B (en) | Road traffic state prediction system based on traffic state time sequence | |
| CN112201069A (en) | Deep reinforcement learning-based method for constructing longitudinal following behavior model of driver | |
| CN112132430B (en) | Reliability evaluation method and system for distributed state sensor of power distribution main equipment | |
| CN112235043B (en) | Distributed optical fiber abnormal data restoration device based on self-adaptive long-term and short-term memory | |
| CN110401978A (en) | Indoor orientation method based on neural network and particle filter multi-source fusion | |
| CN110991776A (en) | Method and system for realizing water level prediction based on GRU network | |
| CN111813858B (en) | Distributed neural network hybrid synchronous training method based on self-organizing grouping of computing nodes | |
| CN111967308A (en) | Online road surface unevenness identification method and system | |
| CN114861875A (en) | Internet of things intrusion detection method based on self-supervision learning and self-knowledge distillation | |
| CN109117352B (en) | Server performance prediction method and device | |
| CN116259172A (en) | Urban road speed prediction method considering space-time characteristics of traffic network | |
| CN115342814A (en) | Unmanned ship positioning method based on multi-sensor data fusion | |
| CN111895986A (en) | MEMS gyroscope original output signal noise reduction method based on LSTM neural network | |
| CN116930609A (en) | Electric energy metering error analysis method based on ResNet-LSTM model | |
| CN113610147A (en) | Multi-potential subspace information fusion earthquake short-term prediction method based on LSTM | |
| CN114048546B (en) | Method for predicting residual service life of aeroengine based on graph convolution network and unsupervised domain self-adaption | |
| CN114389736B (en) | Time synchronization safety monitoring method and system based on long-term and short-term memory network | |
| CN115297496A (en) | Link quality prediction method combining Bi-LSTM and time mode attention | |
| CN113657520A (en) | Intrusion detection method based on deep confidence network and long-time and short-time memory network | |
| CN113159395A (en) | Deep learning-based sewage treatment plant water inflow prediction method and system | |
| CN113156473A (en) | Self-adaptive discrimination method for satellite signal environment of information fusion positioning system | |
| CN109187898B (en) | Soft measurement method and device for ammonia nitrogen content of water in aquaculture environment | |
| CN113328881B (en) | Topology sensing method, device and system for non-cooperative wireless network |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |